CVE-2025-66286CWE-639

CVE-2025-66286

Medium · published April 23, 2026

CVSS v3.1
4.7
EPSS
0%
Percentile
13.3
In the wild
Unconfirmed
What it is

An API design flaw in WebKitGTK and WPE WebKit allows untrusted web content to unexpectedly perform IP connections, DNS lookups, and HTTP requests. Applications expect to use the

WebPage::send-request signal handler to approve or reject all network requests. However, certain types of HTTP requests bypass this signal handler.

The record
Technical detail
CVSS v3.1
4.7 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00233 · 13.3th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-04-23T17:16Z
References (3)
https://access.redhat.com/security/cve/CVE-2025-66286 · [email protected]https://bugs.webkit.org/show_bug.cgi?id=259787 · [email protected]https://bugzilla.redhat.com/show_bug.cgi?id=2424652 · [email protected]
EPSS history
Timeline
  • 23 APR 12:33Z
    Webkitgtk: authorization bypass through webpage::send-request signal handler
    cvelistv5